@unbrained/pm-web 2026.9.23 → 2026.10.5

package/dist/routes/pm.js

@@ -18,6 +18,16 @@ import { pool } from "../db.js";
 // Singleton Neo4j driver — reused across sync calls to avoid per-call connection overhead.
 let _neo4jDriver = null;
 let _neo4jDriverKey = "";
+/** Require complete graph credentials before provisioning extensions or opening a driver. */
+function requireNeo4jCredentials() {
+    const uri = process.env.NEO4J_URI;
+    const user = process.env.NEO4J_USER ?? process.env.NEO4J_USERNAME;
+    const password = process.env.NEO4J_PASSWORD;
+    if (!uri || !user || !password) {
+        throw new Error("Set NEO4J_URI, NEO4J_USER, and NEO4J_PASSWORD before syncing the graph.");
+    }
+    return { uri, user, password };
+}
 /**
  * Return the process-wide Neo4j driver, recreating it when the connection key changes.
  *
@@ -34,9 +44,7 @@ let _neo4jDriverKey = "";
  * credential cannot leak through a value held for the lifetime of the process.
  */
 function getNeo4jDriver() {
-    const uri = process.env.NEO4J_URI ?? "";
-    const user = process.env.NEO4J_USER ?? process.env.NEO4J_USERNAME ?? "";
-    const password = process.env.NEO4J_PASSWORD ?? "";
+    const { uri, user, password } = requireNeo4jCredentials();
     const key = `${uri}:${user}:${createHash("sha256").update(password).digest("hex")}`;
     if (!_neo4jDriver || _neo4jDriverKey !== key) {
         if (_neo4jDriver) {
@@ -224,13 +232,19 @@ function normalizeDependencyKind(input) {
  */
 function graphFromItems(items, depsByItem) {
     const nodesById = new Map();
+    const itemIds = new Set(items.map((item) => item.id));
     const relationships = [];
+    const relationshipKeys = new Set();
     const addNode = (node) => {
         if (!nodesById.has(node.id))
             nodesById.set(node.id, node);
     };
     const addRelationship = (from, to, type, properties) => {
-        if (!nodesById.has(to) && !items.some((item) => item.id === to)) {
+        const key = JSON.stringify([from, to, type]);
+        if (relationshipKeys.has(key))
+            return;
+        relationshipKeys.add(key);
+        if (!nodesById.has(to) && !itemIds.has(to)) {
             addNode({
                 id: to,
                 labels: ["ExternalPmItem"],
@@ -273,16 +287,11 @@ function graphFromItems(items, depsByItem) {
             ...(item.dependencies ?? []),
             ...(depsByItem.get(item.id) ?? []),
         ];
-        const seenDeps = new Set();
         for (const dep of deps) {
             const target = dependencyTarget(dep);
             if (!target)
                 continue;
             const type = graphRelationshipType(dep.type ?? dep.kind ?? dep.relation ?? dep.rel ?? dep.relationship);
-            const key = `${item.id}->${target}:${type}`;
-            if (seenDeps.has(key))
-                continue;
-            seenDeps.add(key);
             addRelationship(item.id, target, type, { ...dep });
         }
         const facetLinks = [
@@ -319,7 +328,7 @@ function graphFromItems(items, depsByItem) {
         generatedAt: new Date().toISOString(),
         source: "pm-web",
         nodes: Array.from(nodesById.values()),
-        relationships: relationships.filter((rel, index, all) => all.findIndex((candidate) => candidate.from === rel.from && candidate.to === rel.to && candidate.type === rel.type) === index),
+        relationships,
     };
 }
 function graphProjectKey(project) {
@@ -338,12 +347,6 @@ function graphProjectKey(project) {
  * @returns The number of nodes and relationships written from the graph.
  */
 async function syncGraphToNeo4j(graph, projectKey) {
-    const uri = process.env.NEO4J_URI;
-    const user = process.env.NEO4J_USER ?? process.env.NEO4J_USERNAME;
-    const password = process.env.NEO4J_PASSWORD;
-    if (!uri || !user || !password) {
-        throw new Error("Set NEO4J_URI, NEO4J_USER, and NEO4J_PASSWORD before syncing the graph.");
-    }
     const driver = getNeo4jDriver();
     const session = driver.session({ database: process.env.NEO4J_DATABASE });
     try {
@@ -361,7 +364,9 @@ async function syncGraphToNeo4j(graph, projectKey) {
     }
     return { syncedNodes: graph.nodes.length, syncedRelationships: graph.relationships.length };
 }
+/** Validate graph configuration before assembling a project graph or provisioning its extension. */
 async function syncProjectGraph(project) {
+    requireNeo4jCredentials();
     const extensionGraph = await pmGraphExtensionGraphForProject(project);
     const graph = extensionGraph.graph ?? await fallbackGraphForProject(project.ownerUserId, project.slug);
     return syncGraphToNeo4j(graph, graphProjectKey(project));
@@ -446,7 +451,7 @@ function itemsFromCompleteList(parsed) {
  * @returns A pm-web-sourced project graph.
  */
 async function fallbackGraphForProject(ownerUserId, slug) {
-    const itemsResult = await readCompletePmItems(ownerUserId, slug);
+    const itemsResult = await readCompletePmItems(ownerUserId, slug, false, true);
     if (!itemsResult.ok)
         throw new Error(itemsResult.stderr || "Failed to load items for graph");
     const items = itemsFromCompleteList(itemsResult.result);
@@ -457,8 +462,8 @@ async function fallbackGraphForProject(ownerUserId, slug) {
 /**
  * Fetch a project graph from the `pm-graph` extension, when installed.
  *
- * Ensures the extension is provisioned for the project (returning `{ error }`
- * if that fails), runs `pm-graph export --json`, and parses its output. Returns
+ * Used only by edit-protected graph sync. Provisions the extension if needed,
+ * then runs `pm-graph export --json` and parses its output. Returns
  * `{ graph }` when the extension produced valid JSON with a graph, otherwise an
  * `{ error }` so the caller can fall back to a pm-web-built graph.
  *
@@ -467,9 +472,8 @@ async function fallbackGraphForProject(ownerUserId, slug) {
  */
 async function pmGraphExtensionGraphForProject(project) {
     const provision = await ensureGraphExtension(project.ownerUserId, project.slug);
-    if (!provision.ok) {
+    if (!provision.ok)
         return { error: provision.error };
-    }
     const extensionResult = await projectPm(project, ["pm-graph", "export", "--json"], false);
     let extensionData;
     if (extensionResult.ok && extensionResult.stdout) {
@@ -845,42 +849,24 @@ router.post("/items/:itemId/history-repair", async (req, res) => {
     }
     res.json(result.parsed || { ok: true, id: itemId });
 });
-// GET /api/projects/:projectId/pm/list
-router.get("/list", async (req, res) => {
-    const project = await requireProject(req, res);
-    if (!project)
-        return;
-    const { status, type, limit, priority, sprint, release, assignee, after } = req.query;
-    const result = await runCursorList(res, project, ["list"], [
-        ["--status", status],
-        ["--type", type],
-        ["--limit", limit],
-        ["--priority", priority],
-        ["--sprint", sprint],
-        ["--release", release],
-        ["--assignee", assignee],
-    ], after);
-    if (!result)
-        return;
-    res.json(result.ok ? (result.parsed || {}) : { error: result.stderr, items: [] });
-});
-// GET /api/projects/:projectId/pm/list-all
-router.get("/list-all", async (req, res) => {
-    const project = await requireProject(req, res);
-    if (!project)
-        return;
-    const { type, limit, after } = req.query;
-    // Preserve the public HTTP compatibility route while invoking the canonical
-    // CLI/SDK command internally. This route is intentionally paginated and is
-    // therefore distinct from readCompletePmItems used by whole-corpus views.
-    const result = await runCursorList(res, project, ["list", "--all"], [
-        ["--type", type],
-        ["--limit", limit],
-    ], after);
-    if (!result)
-        return;
-    res.json(result.ok ? (result.parsed || {}) : { error: result.stderr, items: [] });
-});
+// Keep the public /list-all compatibility route paginated while invoking the
+// canonical CLI/SDK list --all command. Whole-corpus views use readCompletePmItems.
+for (const route of [
+    { path: "/list", args: ["list"], filters: ["status", "type", "limit", "priority", "sprint", "release", "assignee"] },
+    { path: "/list-all", args: ["list", "--all"], filters: ["type", "limit"] },
+]) {
+    router.get(route.path, async (req, res) => {
+        const project = await requireProject(req, res);
+        if (!project)
+            return;
+        const query = req.query;
+        const flags = route.filters.map((key) => [`--${key}`, query[key]]);
+        const result = await runCursorList(res, project, route.args, flags, query.after);
+        if (!result)
+            return;
+        res.json(result.ok ? (result.parsed || {}) : { error: result.stderr, items: [] });
+    });
+}
 // GET /api/projects/:projectId/pm/board
 // Kanban board: items grouped into columns by the workspace's runtime statuses
 // (read live from `pm contracts`) so the board matches the installed CLI.
@@ -1382,21 +1368,11 @@ router.get("/graph", async (req, res) => {
     const project = await requireProject(req, res);
     if (!project)
         return;
-    const extensionGraph = await pmGraphExtensionGraphForProject(project);
-    if (extensionGraph.graph) {
-        res.json({
-            ok: true,
-            graph: extensionGraph.graph,
-            extensionAvailable: true,
-        });
-        return;
-    }
     try {
         res.json({
             ok: true,
             graph: await fallbackGraphForProject(project.ownerUserId, project.slug),
             extensionAvailable: false,
-            extensionError: extensionGraph.error,
         });
     }
     catch (err) {
@@ -1445,18 +1421,32 @@ router.get("/graph/neighbors/:nodeId", async (req, res) => {
         res.status(400).json({ error: "nodeId is required" });
         return;
     }
-    const result = await projectPm(project, ["pm-graph", "neighbors", nodeId, "--json"], false);
-    if (!result.ok) {
-        // Extension not available — return empty neighbors
-        res.json({ ok: true, center: null, neighbors: [], extensionAvailable: false, error: result.stderr || "pm-graph extension not available" });
-        return;
-    }
     try {
-        const parsed = result.stdout ? JSON.parse(result.stdout) : null;
-        res.json({ ok: true, ...parsed, extensionAvailable: true });
+        const graph = await fallbackGraphForProject(project.ownerUserId, project.slug);
+        const nodesById = new Map(graph.nodes.map((node) => [node.id, node]));
+        const center = nodesById.get(nodeId);
+        if (!center) {
+            res.json({ ok: true, center: null, neighbors: [], extensionAvailable: false, message: `No node found with id "${nodeId}".` });
+            return;
+        }
+        const neighbors = graph.relationships
+            .filter((edge) => edge.from === nodeId || edge.to === nodeId)
+            .map((edge) => {
+            // graphFromItems creates both endpoint nodes for every relationship.
+            const node = nodesById.get(edge.from === nodeId ? edge.to : edge.from);
+            return {
+                node: { ...node.properties, _labels: node.labels },
+                relationship: {
+                    type: edge.type,
+                    direction: edge.from === nodeId ? "outgoing" : "incoming",
+                    properties: { ...edge.properties, _type: edge.type },
+                },
+            };
+        });
+        res.json({ ok: true, center: { ...center.properties, _labels: center.labels }, neighbors, extensionAvailable: false });
     }
-    catch {
-        res.json({ ok: true, center: null, neighbors: [], extensionAvailable: false, error: "pm-graph neighbors returned invalid JSON" });
+    catch (err) {
+        res.status(400).json({ error: err instanceof Error ? err.message : String(err) });
     }
 });
 // POST /api/projects/:projectId/pm/graph/query
@@ -1562,9 +1552,13 @@ router.post("/tests/:itemId", async (req, res) => {
         res.status(400).json({ error: "Test command is required" });
         return;
     }
-    const args = ["test", routeParam(req, "itemId"), "--add", "--command", command.trim()];
-    if (description)
-        args.push("--description", description.trim());
+    // `pm item test --add` takes one CSV/JSON argument; the historical
+    // `--add --command <value>` token shape is rejected by the CLI, so every
+    // add from the UI failed with a usage error. JSON keeps the user's command
+    // verbatim even when it contains commas or equals signs, and the optional
+    // description rides along as the `note` key.
+    const test = description?.trim() ? { command: command.trim(), note: description.trim() } : { command: command.trim() };
+    const args = ["test", routeParam(req, "itemId"), "--add-json", JSON.stringify(test)];
     const result = await runMutation(res, project, args, "Failed to add test");
     if (!result)
         return;
@@ -1922,10 +1916,23 @@ router.post("/close-many", async (req, res) => {
         return;
     }
     const targetStatus = body.targetStatus === "canceled" ? "canceled" : "closed";
-    // First, use update-many --dry-run to get the list of matched items
-    const listArgs = ["update-many", "--dry-run", "--status", "open"];
+    // First, use update-many --dry-run to get the list of matched items.
+    // --filter-status selects rows; --status would instead *set* every matched
+    // item's status in the preview, and with no other update flags present the
+    // match set silently widened to the whole project — closed items included.
+    // The status filter is authoritative and passed exactly once: the caller may
+    // narrow to another non-terminal status, but `pm` keeps only the last repeated
+    // flag, so appending a second --filter-status could re-select terminal items.
+    const statusFilter = body.filterStatus?.trim() || "open";
+    // `pm` accepts comma-separated status lists and matches them case- and
+    // whitespace-insensitively, so every token is normalised before the check.
+    if (statusFilter.split(",").some((status) => ["closed", "canceled", "cancelled"].includes(status.trim().toLowerCase()))) {
+        res.status(400).json({ error: "close-many only selects non-terminal items; filterStatus cannot be closed or canceled" });
+        return;
+    }
+    const listArgs = ["update-many", "--dry-run", "--filter-status", statusFilter];
     const filterFlags = {
-        filterStatus: "--filter-status", filterType: "--filter-type",
+        filterType: "--filter-type",
         filterTag: "--filter-tag", filterPriority: "--filter-priority",
         filterAssignee: "--filter-assignee", filterParent: "--filter-parent",
         filterSprint: "--filter-sprint", filterRelease: "--filter-release",
@@ -2236,9 +2243,13 @@ router.post("/plan/:planId/steps", async (req, res) => {
         res.status(400).json({ error: "Title is required" });
         return;
     }
-    const args = ["plan", "add-step", routeParam(req, "planId"), "--title", title.trim()];
+    // `pm plan add-step` takes the step title on --step-title and the step body
+    // on --step-body; --title/--description address the plan itself, so routing
+    // the request's fields there would fail the whole call (add-step rejects
+    // --title as a missing --step-title) or write to the wrong record.
+    const args = ["plan", "add-step", routeParam(req, "planId"), "--step-title", title.trim()];
     if (description)
-        args.push("--description", description);
+        args.push("--step-body", description);
     if (dependsOn)
         args.push("--depends-on", dependsOn);
     await runPlanMutation(req, res, project, args, "Failed to add step", 201);
@@ -2248,8 +2259,16 @@ router.patch("/plan/:planId/steps/:stepRef", async (req, res) => {
     const project = await requireProject(req, res);
     if (!project)
         return;
+    // Step edits go to --step-title/--step-body. The plan-level --title/--
+    // --description flags are silently ignored by `pm plan update-step`, so
+    // routing a step edit through them returned success while dropping the
+    // user's change on the floor.
+    const body = req.body;
     const args = ["plan", "update-step", routeParam(req, "planId"), routeParam(req, "stepRef")];
-    pushTitleDescArgs(args, req.body);
+    if (body.title?.trim())
+        args.push("--step-title", body.title.trim());
+    if (body.description !== undefined)
+        args.push("--step-body", body.description);
     await runPlanMutation(req, res, project, args, "Failed to update step");
 });
 // POST /api/projects/:projectId/pm/plan/:planId/steps/:stepRef/complete
@@ -2321,39 +2340,37 @@ router.post("/plan/:planId/steps/:stepRef/reorder", async (req, res) => {
     }
     await runPlanMutation(req, res, project, ["plan", "reorder-step", routeParam(req, "planId"), routeParam(req, "stepRef"), String(reorderTo)], "Failed to reorder step");
 });
-// POST /api/projects/:projectId/pm/plan/:planId/link
-router.post("/plan/:planId/link", async (req, res) => {
+/** Execute plan linking or unlinking with the CLI's required step positional. */
+async function mutatePlanLink(req, res, action) {
     const project = await requireProject(req, res);
     if (!project)
         return;
-    const { link, linkKind, linkNote, promoteToItemDep } = req.body;
+    const { link, step } = req.body;
     if (!link?.trim()) {
         res.status(400).json({ error: "link (item id) is required" });
         return;
     }
-    const args = ["plan", "link", routeParam(req, "planId"), "--link", link.trim()];
-    if (linkKind)
-        args.push("--link-kind", linkKind);
-    if (linkNote)
-        args.push("--link-note", linkNote);
-    if (promoteToItemDep === "true")
-        args.push("--promote-to-item-dep");
-    await runPlanMutation(req, res, project, args, "Failed to link plan", 201);
-});
-// DELETE /api/projects/:projectId/pm/plan/:planId/link
-router.delete("/plan/:planId/link", async (req, res) => {
-    const project = await requireProject(req, res);
-    if (!project)
-        return;
-    const { link, linkKind } = req.body;
-    if (!link?.trim()) {
-        res.status(400).json({ error: "link (item id) is required" });
+    if (!step?.trim()) {
+        res.status(400).json({ error: "step (step id or order) is required" });
         return;
     }
-    const args = ["plan", "unlink", routeParam(req, "planId"), "--link", link.trim()];
+    const { linkKind, linkNote, promoteToItemDep } = req.body;
+    const args = ["plan", action, routeParam(req, "planId"), step.trim(), "--link", link.trim()];
     if (linkKind)
         args.push("--link-kind", linkKind);
-    await runPlanMutation(req, res, project, args, "Failed to unlink plan");
+    if (action === "link") {
+        if (linkNote)
+            args.push("--link-note", linkNote);
+        if (promoteToItemDep === "true")
+            args.push("--promote-to-item-dep");
+    }
+    await runPlanMutation(req, res, project, args, `Failed to ${action} plan`, action === "link" ? 201 : 200);
+}
+router.post("/plan/:planId/link", async (req, res) => {
+    await mutatePlanLink(req, res, "link");
+});
+router.delete("/plan/:planId/link", async (req, res) => {
+    await mutatePlanLink(req, res, "unlink");
 });
 // GET /api/projects/:projectId/pm/upgrade
 // Returns a dry-run preview of what upgrade would do (safe, read-only).